chore(deps): Upgrade Netty to 4.2.18.Final - #26346
Merged
Merged
Conversation
Backport of #26345 to camel-4.22.x. Bug-fix and security release. Netty 4.2.18.Final ships fixes for 30 reported vulnerabilities across the HTTP/1.1, HTTP/2, HTTP/3, SMTP, STOMP, MQTT, Redis, memcache, HAProxy and OCSP codecs (request/response smuggling, improper header validation, unbounded resource usage and memory leaks). No CVE ids were assigned in time for the release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Claus Ibsen <claus.ibsen@gmail.com> (cherry picked from commit e82ced4)
Contributor
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
gnodet-bot
approved these changes
Sep 12, 2026
gnodet-bot
left a comment
gnodet-bot
left a comment
Contributor
There was a problem hiding this comment.
Clean backport of #26345 to camel-4.22.x. Single-line version bump 4.2.17.Final → 4.2.18.Final — a security release fixing 23+ vulnerabilities across Netty HTTP, HTTP/2, HTTP/3, STOMP, MQTT, memcache and OCSP modules. Cherry-pick context conflict trivially resolved (adjacent neoscada-version/neo4j-version lines untouched). Upstream behaviour changes (HTTP/2 header value validation now on by default, QUIC hostname verification strictened) are both security-hardening — no breaking impact on Camel's usage.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
Contributor
|
🧪 CI tested the following changed modules:
✅ POM dependency changes: targeted tests included Changed properties: netty-version Modules affected by dependency changes (3)
🔬 Scalpel shadow comparison — Scalpel: 37 tested, 27 compile-only — current: 0 all testedMaveniverse Scalpel detected 64 affected modules (current approach: 0).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #26345 to
camel-4.22.x.Upgrades Netty from
4.2.17.Finalto4.2.18.Final(released 2026-09-09).Why
This is a bug-fix and security release. The Netty team lists 30 reported vulnerabilities fixed across the HTTP/1.1, HTTP/2, HTTP/3, SMTP, STOMP, MQTT, Redis, memcache, HAProxy and OCSP modules — request/response smuggling, improper header and certificate validation, unbounded resource usage and memory leaks. No CVE ids were assigned in time for the release ("due to overwhelming strain on the CVE infrastructure"), so the advisories are published without them.
Release notes: https://netty.io/news/2026/09/09/4-2-18-Final.html
Behaviour changes called out by upstream
X509ExtendedTrustManagerwhen hostname verification is enabled — previously verification was silently skipped with a plainX509TrustManager, now it throws.Note on the cherry-pick
The cherry-pick needed a trivial context conflict resolution:
camel-4.22.xcarriesneoscada-versionandneo4j-version 6.2.0on the adjacent lines. Only thenetty-versionline is changed here — the resulting diff is the same one-line bump as onmain.Testing
mvn verifywas run onmainfor the two directly affected modules (camel-netty: 125 tests,camel-netty-http: 274 tests, all green). The change is identical here.Claude Code on behalf of davsclaus